Nigerian SMEs face a cybersecurity paradox. Their risk exposure is not significantly lower than that of large enterprises, they process customer payment data, hold staff personal information, communicate via email, and operate systems connected to the internet. But their capacity to invest in security is a fraction of what a large organisation can deploy. The result is that the controls applied are often inadequate, and incidents that a large organisation absorbs as a manageable cost can be existential for a smaller one.
This is not an argument for ignoring the problem. It is an argument for being deliberate about which controls deliver the most risk reduction per naira spent. This article sets out a practical baseline, the measures that matter most, and explains why each one is important in the Nigerian context.
Understanding the threat landscape for Nigerian SMEs
Before addressing controls, it helps to understand what actually threatens Nigerian small businesses. The threat landscape is not dominated by sophisticated nation-state attackers. The most common threats are:
Business email compromise (BEC): An attacker gains access to a business email account, often through a phished password, and uses it to divert payments, redirect supplier invoices, or extract sensitive information. Nigerian businesses have lost substantial amounts to this attack type, and the attack does not require any technical sophistication to execute.
Ransomware: Malware encrypts files and demands payment for decryption. Ransomware operators increasingly target SMEs because they are less likely to have good backups or security controls, making them more likely to pay. Attacks typically enter through phishing emails or through remote access tools with weak authentication.
Credential stuffing and account takeover: When passwords stolen from one service are tried against others. Staff who reuse passwords across personal and work accounts create vulnerability that organisations cannot see.
Insider incidents: Deliberate data theft by departing staff, or accidental data exposure by well-meaning employees who do not understand the risk. This is often underreported.
Social engineering via phone and WhatsApp: Attackers impersonate suppliers, customers, or IT staff to extract credentials or authorise transactions. This works in Nigeria partly because verification habits are weak in many organisations.
The baseline controls
1. Multi-factor authentication on all internet-facing accounts
This single control would prevent or substantially complicate the majority of business email compromise incidents. MFA requires a second factor, typically a code from a mobile app, in addition to a password. Even if an attacker obtains a password, MFA prevents them from using it to access the account.
Priority accounts for MFA: email (Microsoft 365 or Google Workspace), banking portals, accounting software, cloud storage, any portal that holds customer data.
MFA should be mandatory, not optional. Optional MFA means the accounts that most need it are often the ones where it is not enabled.
2. Endpoint protection that is actually managed
Antivirus software installed on laptops and desktops is a basic requirement, but the software sitting unmanaged on individual devices, with outdated definitions and expired licenses, is not a security control. It is a false reassurance. Endpoint protection is a control when it is centrally managed, with current definitions applied to all devices, alerts reviewed by someone, and the coverage verified regularly.
For SMEs without internal IT capacity, this is a legitimate reason to consider managed IT support where endpoint management is part of the service scope.
3. Patch management on a defined schedule
Unpatched software is the primary entry point for many attacks. Windows, Office, web browsers, and third-party applications accumulate known vulnerabilities over time; patches are released to fix them. Organisations that patch consistently are substantially harder to attack than those that do not.
A realistic patch schedule for an SME: critical OS patches within 48 hours of release; all other patches on a monthly cycle. For organisations without a dedicated IT team, automating patch deployment, through Windows Update or a management platform, is better than relying on manual processes that will slip under operational pressure.
4. Backup with verified restoration
Backup is the control that determines whether a ransomware attack is a crisis or an inconvenience. Organisations with current, tested backups can restore their systems without paying a ransom. Organisations without them face the choice between paying and losing their data.
The requirements for backup to work as a security control:
- Frequency: Daily backup of all critical data at a minimum
- Offsite copy: At least one backup copy held separately, cloud storage or a physically separate location, so that ransomware encrypting the primary environment cannot reach the backup
- Air gap: The backup should not be continuously mounted and writable from the production environment; ransomware will encrypt writable network shares
- Tested restoration: Backup jobs completing is not evidence that restoration works; restoration should be tested quarterly and the results documented
5. Email security controls
Email is the primary delivery vector for phishing and malware. Several controls reduce the risk:
- SPF, DKIM, and DMARC records configured for your domain, these prevent attackers from sending email that appears to come from your domain, reducing the effectiveness of impersonation attacks against your clients and partners
- Email filtering that scans for malicious attachments and links before they reach users' inboxes
- Attachment execution policies that prevent automatically running macros in Office documents from unknown sources
6. Access control and privilege management
Users should have access to the systems and data their role requires, not everything. Administrator rights should be held by the minimum number of people necessary, and they should not be used for routine daily work. A staff member who handles daily operations with administrator privileges creates significant risk: malware running in their session inherits their permissions.
When staff leave, their accounts should be disabled immediately, before or on their last working day. This is one of the most frequently overlooked controls in Nigerian SMEs, where informal HR processes mean departing staff sometimes retain active account access for weeks or months.
Cybersecurity for an SME is not about having every control a bank has. It is about closing the gaps that attackers actually exploit against businesses your size, and doing so consistently, not occasionally.
7. Staff awareness
Most successful attacks involve a human element, a password given to someone who asked for it, a malicious attachment opened, an invoice paid without proper verification. Technical controls reduce exposure significantly, but staff behaviour remains a material variable.
Effective awareness is not a once-a-year presentation. It is regular, brief, and practical: a monthly email on current phishing patterns, a simulation exercise that shows staff what a phishing email actually looks like, a clear process for reporting suspicious messages without fear of blame.
NDPR obligations for SMEs
The Nigeria Data Protection Regulation applies to organisations that process personal data of Nigerian citizens, regardless of organisation size. SMEs that hold customer names, contact information, staff records, or transaction data are within scope.
The NDPR requires, among other things, that organisations implement appropriate technical and organisational measures to protect personal data. For SMEs, this means that the controls described above are not only sensible risk management, they are part of a compliance obligation. NITDA has the authority to impose penalties for data breaches where adequate security measures were not in place.
Nigerian SMEs should conduct a brief data mapping exercise, identifying what personal data they hold, where it is stored, and who has access, as a starting point for understanding their NDPR exposure.
Where to start
If your organisation has not yet addressed these controls systematically, the priority order is:
- MFA on email and banking portals, highest impact, lowest cost, can begin today
- Verified backup with offsite copy, existential risk if absent
- Patch management on a defined schedule, prevents the majority of exploit-based attacks
- Account cleanup, disable former staff accounts, review who has admin rights
- Email security records (SPF/DKIM/DMARC), protects your brand and your clients simultaneously
The remaining controls follow once the foundation is in place. For organisations without in-house IT capability, engaging a managed IT partner who treats security controls as part of the service, not an optional add-on, is a practical route to consistent coverage.
Frequently asked questions
Are Nigerian SMEs really targeted by cybercriminals?
Yes. Automated attacks do not discriminate by organisation size; they scan the internet for vulnerable systems and attempt to compromise them regardless of who owns them. SMEs are also increasingly targeted deliberately, because attackers know they are less likely to have strong controls or the ability to absorb and recover from an incident without paying.
What is the most important single security control for a small business?
Multi-factor authentication on email and financial portals delivers the most risk reduction per unit of effort for most small businesses. Business email compromise, where an attacker gains access to email and uses it to divert payments, is among the most financially damaging attacks on Nigerian SMEs, and MFA stops the majority of these attacks even when passwords are compromised.
How does the NDPR affect small businesses?
The NDPR applies to any organisation processing personal data of Nigerian residents, including small businesses. The regulation requires appropriate security measures, a data protection policy, and breach notification obligations. NITDA can investigate and impose penalties following a breach. SMEs should at minimum understand what personal data they hold and implement baseline technical controls.
What should an SME do if it suspects a cyber incident?
Immediately isolate the affected system from the network, disconnect from Wi-Fi or unplug the ethernet cable. Do not attempt to interact with ransom demands or delete files before getting professional advice. Contact your IT support provider or a cybersecurity incident response firm. Preserve evidence: logs, screenshots of error messages, the timeline of events. Report significant incidents to NITDA and, where financial fraud is involved, your bank and law enforcement.
